How to Enroll a Mac in Microsoft Intune: Step-by-Step Guide

Mac enrollment in Microsoft Intune brings macOS devices under the same Mobile Device Management (MDM) control as Windows endpoints, with no on-premises infrastructure required. Specifically, this guide covers the Apple MDM push certificate, three enrollment methods, PowerShell licensing, and Conditional Access for compliance. It also addresses US-regulated-industry baselines (HIPAA, SOC 2, NIST 800-171). Furthermore, every recommendation comes from what Wintive observed across 60+ Microsoft 365 tenants we audit yearly.

💡 Why Mac Enrollment in Intune Matters in 2026

SMBs increasingly run mixed Windows-Mac fleets, especially in creative, legal, and consulting practices. Without MDM, every enrolled Mac is a blind spot: no compliance reporting, no remote wipe, no Conditional Access enforcement. Therefore, unmanaged Macs are the fastest-growing audit gap in our 60+ tenant baseline.

Intune unifies device control: one portal, one compliance policy engine, one Conditional Access rule set covering Windows, macOS, iOS, and Android. As a result, IT teams stop maintaining a parallel Mac process and audit evidence becomes consistent across endpoint types.

Before diving into the configuration steps, confirm your environment meets the prerequisites below. Notably, missing the Apple MDM Push Certificate or an unassigned Intune license accounts for about 40% of failed first-time Mac enrollments we troubleshoot.

✅ Prerequisites for Mac Enrollment in Intune

🔧 How Mac Enrollment Works in Intune

Three Microsoft and Apple services collaborate during enrollment. First, the user authenticates against Microsoft Entra ID through the Company Portal app. Second, Microsoft Intune issues an MDM management profile to the Mac. Third, the Apple Push Notification Service (APNs) delivers ongoing MDM commands once the profile is installed.

Notably, the APNs channel runs on TCP 5223 outbound. If your firewall or proxy blocks that port, MDM commands silently queue and the Mac appears Pending in the Intune portal. Therefore, validating outbound 5223 to *.push.apple.com is the first network check in any Mac enrollment troubleshooting workflow.

Beyond port 5223, several Apple endpoints must remain reachable from the Mac. Specifically, gateway.icloud.com on TCP 443, *.apple.com on TCP 443, and captive.apple.com for network-quality probes. Crucially, SSL inspection on these domains breaks MDM enrollment outright: Apple pins certificates and rejects man-in-the-middle proxies. Therefore, the operational baseline for any corporate proxy is to bypass SSL inspection on *.apple.com and *.push.apple.com. Indeed, this single proxy exception resolves about 70% of stuck-enrollment cases we troubleshoot in tenant audits.

📦 Mac Enrollment Methods Compared

Intune supports three enrollment paths for macOS, each tailored to a different deployment scale and ownership model. Specifically, the right method depends on whether the Mac is corporate-purchased through Apple Business Manager, BYOD, or in-place from existing inventory.

For most SMBs we audit, user-driven enrollment is the practical default: it works on existing Macs without re-imaging, requires no Apple Business Manager subscription, and lets users self-enroll within minutes. Conversely, organizations with monthly Mac procurement should invest in Apple Business Manager for true zero-touch deployment.

💻 Configure Mac Enrollment Step-by-Step

The full configuration runs through the Microsoft Intune admin center. Notably, you complete steps 1 and 2 once per tenant, then repeat steps 3 and 4 for each user.

1. Apple MDM Push Certificate — Devices → Enroll devices → Apple enrollment → download CSR, upload to Apple Push Certificates Portal, return PEM to Intune
2. Enrollment program tokens (ABM/ADE only) — required for zero-touch; skip if user-driven
3. Assign Intune license to each Mac user (PowerShell example below)
4. User installs Company Portal from Mac App Store, signs in, accepts management profile in System Settings → Privacy & Security → Profiles

For bulk operations or scripted onboarding, assign the Intune license through Microsoft Graph PowerShell. The script below assigns the Microsoft 365 Business Premium SKU (which includes Intune); replace the SKU GUID with your tenant value returned by Get-MgSubscribedSku.

# Assign Intune license to a Mac user via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"

# List available SKUs to find the right one
Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, ConsumedUnits, @{N="Available";E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}}

# Assign Microsoft 365 Business Premium (replace SkuId with your tenant value)
$user = "jane.doe@example.com"
$skuId = "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46"
$license = @{ AddLicenses = @(@{ SkuId = $skuId }); RemoveLicenses = @() }
Set-MgUserLicense -UserId $user -BodyParameter $license

# Verify Intune service plan is enabled
Get-MgUserLicenseDetail -UserId $user | Select-Object -ExpandProperty ServicePlans | Where-Object ServicePlanName -like "*INTUNE*"

🛡️ Mac Compliance for Regulated US Industries

For organizations subject to HIPAA, SOC 2 Type II, NIST 800-171, or the CIS Benchmarks for Apple, simply enrolling a Mac in Intune is not enough. Auditors expect documented, enforced controls on every macOS endpoint accessing PHI, customer data, or controlled unclassified information (CUI).

Specifically, the combination of an Intune compliance policy and a Conditional Access rule provides exactly that. Non-compliant Macs are blocked from corporate resources at sign-in, and the evidence appears in Entra ID sign-in logs for audit retrieval.

The minimum compliance baseline for US regulated environments has four parts. First, require FileVault disk encryption. Second, enforce a minimum macOS version aligned with Apple’s current security update window. Third, set a password complexity policy with auto-lock under 15 minutes. Fourth, require a recent device check-in (24 hours or less). As a result, this baseline satisfies the macOS portion of HIPAA Security Rule technical safeguards (45 CFR §164.312), SOC 2 Common Criteria CC6.1, and NIST 800-171 control 3.1.18.

For organizations operating in GCC or GCC High tenants, the enrollment workflow is identical, but Intune endpoints route through the sovereign cloud. Therefore, confirm your Mac fleet can reach *.manage.microsoft.us (GCC High) instead of commercial endpoints before starting enrollment.

✅ Best Practices for Mac Enrollment in SMBs

Across audits, the same configuration mistakes appear repeatedly. Notably, three controls account for roughly 80% of enrollment-related incidents: certificate ownership, missing FileVault enforcement, and ungoverned BYOD Macs.

↻ Verify and Troubleshoot Mac Enrollment

After enrollment, verify the device appears in the Intune admin center under Devices → macOS. Confirm the compliance status shows Compliant (or Not evaluated if no policy applies yet) and the last check-in is recent.

You can also verify enrollment from the Mac itself. Open Terminal and run the commands below to confirm the management profile is installed. This is invaluable when the Intune portal still shows Pending hours after enrollment. Such delays usually mean a network or proxy issue is blocking Apple’s push service.

# Run on the enrolled Mac to confirm MDM status

# Show installed enrollment profiles
sudo profiles status -type enrollment

# List configuration profiles (Intune profiles appear as "Microsoft.Profiles.MDM")
sudo profiles list -type configuration

# Detailed view of the management profile
sudo profiles show -type enrollment

# Force a check-in with Intune (useful after policy changes)
sudo /usr/libexec/mdmclient AvailableOSUpdates

For ongoing service health, bookmark the Microsoft 365 Service Health dashboard and the Microsoft Learn enrollment reference. Indeed, both are invaluable when troubleshooting tenant-wide enrollment outages.

🔄 Renew the Apple MDM Push Certificate (Annual Workflow)

The Apple MDM Push Certificate expires every 12 months. Critically, Apple sends no automatic warning to the Intune admin. The certificate simply stops working at midnight on the expiry date. All enrolled Macs lose MDM control overnight. The next morning, your IT team discovers the outage from helpdesk tickets. Therefore, certificate renewal is the single highest-impact preventive task in any Mac MDM operation.

The renewal workflow itself is straightforward, but it must use the same Apple ID as the original certificate. Indeed, using a different Apple ID invalidates every enrolled device. The entire Mac fleet then requires full re-enrollment. We have seen this tenant-wide outage scenario happen twice in audited environments.

1. Sign in to Microsoft Intune admin center → Devices → Enroll devices → Apple enrollment → Apple MDM Push Certificate
2. Click Download CSR to obtain a fresh certificate signing request file
3. Open Apple Push Certificates Portal and sign in with the original Apple ID stored in your service-account vault
4. Locate the existing certificate in the list and click Renew (not Create new) — this preserves the certificate identity
5. Upload the fresh CSR, download the renewed PEM certificate
6. Return to Intune, click Renew on the certificate page, upload the PEM, and confirm the same Apple ID

Notably, set a calendar reminder 30 days before the expiry date in a shared IT mailbox, with the link to the renewal page in the body. Furthermore, schedule a verification check after renewal. Pick three random Macs and confirm they still appear in the Intune portal. Their last check-in time should be recent, within 24 hours of the renewal.

❓ Mac Enrollment in Intune — FAQ

🔗 Keep Exploring

Need help enrolling your Mac fleet in Intune the right way? Wintive runs an Automated Tenant Health Check ($97). The audit covers your Intune device compliance posture, including macOS enrollment status, Apple MDM certificate health, FileVault coverage, and Conditional Access alignment. Furthermore, you receive a 17-page PDF report ready for your auditors within 10 minutes. Built from 60+ Microsoft 365 tenants we audit yearly.